CSRF in Espressif Arduino-esp32

CVE-2025-53540

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Several OTA update examples and the HTTPUpdateServer implementation are vulnerable to Cross-Site Request Forgery (CSRF)…

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.008 (73.9th percentile) — read the EPSS interpretation.

Affected products

Espressif Arduino-esp32 — versions < 3.2.1

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

https://github.com/espressif/arduino-esp32/security/advisories/GHSA-9vfw-wx65-c872 (x_refsource_CONFIRM)
https://github.com/espressif/arduino-esp32/commit/f4fdecc60c465384e465a4b1d2bd1eac8f67912e (x_refsource_MISC)